IR 05000275/1998009
| ML16343A602 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon  |
| Issue date: | 08/19/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML16342E229 | List: |
| References | |
| 50-275-98-09, 50-275-98-9, 50-323-98-09, 50-323-98-9, NUDOCS 9808240252 | |
| Download: ML16343A602 (40) | |
Text
ENCLOSURE 2 U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket Nos.:
License Nos.:
Report No.:
Licensee:
Facility:
Location:
Dates:
Inspectors:
50-275; 50-323 DPR-80; DPR-82 50-275/98-09; 50-323/98-09 Pacific Gas and Electric Company Diablo Canyon Nuclear Power Plant, Units 1 and 2 7 i/a miles NW of Avila Beach Avila Beach, California Onsite May 5-7 and NRC staff in-office review through July 21, 1998 William B. Jones, Senior Reactor Analyst Brad Olson, Project Engineer je Approved By:
Arthur T. Howell III, Director Division of Reactor Safety ATTACHMENT:
Supplemental Information 9808240252
'P808i9 PDR ADGCK 05000275
-2-EXECUTIVE SUMMARY Diablo Canyon Nuclear Power Plant, Units 1 and 2 NRC Inspection Report 50-275/98-09; 50-323/98-09
~En ineerin The 10 CFR 50.59 program was not effectively utilized in four cases to determine whether proposed design or procedural changes represented potential unreviewed safety questions or affected the technical specifications.
Design and procedural changes utilized the 10 CFR 50.59 process as a means of validating design and procedural changes but did not correctly provide a licensing basis determination (Section E1.2).
The procedural change to not split the auxiliary saltwater and component cooling water systems into their respective trains following a loss-of-coolant accident was determined to be a nonsubstantial unreviewed safety question and willnot be cited as provided by Section VII.B.6of the NRC Enforcement Policy (Section E1.1.1).
A violation of 10 CFR 50,59 was identified, with two examples, for changes to the component cooling water system and a procedural revisio'n for the operation of the residual heat removal system during containment recirculation, which involved inadequate 10 CFR 50.59 reviews. The licensee failed to identify that the modification and procedure change involved a change to the technical specifications incorporated in the license (Section E1.1.2 and E1.1.3).
A violation of 10 CFR 50.59 was identified for failing to obtain NRC approval prior to siting a segment of the Unit 1 auxiliary saltwater bypass line on ground not considered bedrock as specified in the Final Safety Analysis Report Update, which was determined by the NRC to involve an unreviewed safety question (Section E1.1.4).
The licensee initiated specific steps to strengthen the 10 CFR 50.59 process including the principle focus being through the regulatory services group; established an open dialogue with the NRC's Office of Nuclear Reactor Regulation regarding 10 CFR 50.59 issues; and implemented a management review committee, consisting of management personnel cognizant of the 10 CFR 50.59 process, to review specific safety evaluations (Section E7.1).
The effectiveness of the licensee's corrective actions to resolve 10 CFR 50.59 implementation issues (identified back to December 1996) had not been fullyrealized and had not been independently assessed by the licensee's quality organization (Section E7.1).
-3-Re ort Details E1 Conduct of Engineering
{37551)
E1.1 10 CFR 50.59 Evaluations The inspectors reviewed four plant modifications and procedure changes, which were previously identified as potential unreviewed safety questions.
Each of these items had been evaluated by the licensee using 10 CFR 50.59, Changes, "Tests and Experiments," which permits the licensee to make changes in the facilityand changes in the procedures as described in the safety analysis report, without prior Commission approval, unless the proposed change involves an unreviewed safety question or a change in the technical specifications incorporated in the license.
Two of the issues, which had been previously identified as unresolved items in NRC Inspection Report 50-275: -323/97202, involved component cooling water and auxiliary saltwater operation during tong-term recovery following a loss-of-coolant accident and use of containment spray during the recirculation phase of a loss-of-coolant accident.
The other two issues reviewed involved component cooling water surge tank pressurization and an auxiliary saltwater system piping bypass modification.
E1.1.1 Com onent Coolin Water and Auxilia Salt Water Train S lit a
a.
Ins ection Sco e
The inspectors reviewed the emergency operating procedure changes in how passive failures in the auxiliary saltwater and component cooling water systems would be mitigated during the long-term recovery period following a loss-of-coolant accident.
The respective license basis impact evaluation and regulatory requirements were reviewed to assess whether the changes involved an unreviewed safety question.
b.
Observations and Findin s Backcaround NRC Inspection Report 50-275; -323/97-202, Section E1.2.1.2.d, identified the changes in the emergency operating procedures'for operation of the auxiliary saltwater and component cooling water in long-term post-loss-of-coolant accident with the trains tied together as Unresolved Item 50-275; -323/97202-03.
Action Request A0421914, "Component Cooling System," was initiated on January 17, 1997, to address a licensee identified concern with separating the auxiliary saltwater and component cooling water trains when aligning for hot-leg recirculation'following a loss-of-coolant accident.
Emergency Operating Procedure E-1A, "Transfer to Hot Leg Recirculation," Revision 13 {Unit 1) and Revision 6 {Unit2), provided for splitting the
~
a
auxiliary saltwater and component cooling water trains to prevent a common mode passive failure (pipe break).
However, the licensee identified that the component cooling water and auxiliary saltwater systems were vulnerable to common mode active failures following hot-leg recirculation when the individual trains were split.
Approximately 10 /~ hours after a design basis loss-of-coolant accident, with the emergency core cooling systems in recirculation from the containment sumps, the emergency operating procedure required the combined auxiliary saltwater system trains and the combined component cooling water system trains to be split into their respective individual trains to mitigate the consequences of a passive failure in the respective systems.
The auxiliary saltwater and component cooling water systems would be initiallyconnected (no train separation).
This configuration provided for active failure protection from the loss of a pump, vital bus failure, etc.
In January 1997, the licensee identified the potential for losing the auxiliary salt'water or component cooling water systems because of an active failure after the trains were separated.
Specifically, a failure of Vital Bus F would result in a loss of power to one train of auxiliary saltwater and the opposite train of component cooling water. A loss of the Vital Bus G would result in a loss of a component cooling water pump and the residual heat removal pump in the opposite train. To protect against an active single failure, which could render long-term heat decay removal inoperable, the licensee determined that the respective trains would remain connected and the responsibility and decision to separate the trains would be made by the Technical Support Center.
Corrective Actions to Address the Common Mode Active Failure To resolve the issue with the loss of emergency core cooling system support equipment in the event of a loss of a vital bus while in hot-leg recirculation, the licensee revised Emergency Operating Procedure E-1.4, "Transfer to Hot Leg Recirculation,"
Revisions 13 and 6, for Units 1 and 2, respectively, to delete the reference to auxiliary saltwater train separation and provide for component cooling water train separation at the discretion of the Technical Support Center.
Step 7 of the procedure required that the Technical Support Center review and provided their recommendation within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the event to ensure the plant can cope with an active and/or passive failure.
Nonconformance Report 2010 and Action Report AR A0421914 were initiated to resolve this concern.
Licensee Event Report 50-275; -323; 1-97-001-00, "The Component Cooling Water System Has Operated With Procedural Guidance That Permitted Operation in a Condition Outside the Design Basis of the Plant," dated March 3, 1997, documented this condition.
The licensee performed a licensing basis impact evaluation in accordance with Procedure TS3.ID2, "Licensing Basis Impact Evaluation Screen," which was completed on January 23, 1997. The licensing basis impact review appropriately identified that the change involved a change to the facility and a change to procedures, system operation, or administrative control over plant activities, as described in the safety analysis repor The licensee subsequently addressed the 10 CFR 50.59 requirements to determine whether an unreviewed safety question existed through a series of seven questions.
The licensee concluded that the emergency operating procedural changes did not constitute an unreviewed safety question.
The licensee identified that there were neither long-nor short-term requirements for postulating passive failures in these moderate energy line systems.
Final Safet Anal sis Re ort U date Review Final Safety Analysis Report Update Section 9.2.2, "Component Cooling Water System,"
and Table 9.2.7, "Component Cooling Water System Malfunction Analysis," identified that the component cooling water system is eventually realigned for long-term recirculation by manually realigning the vital headers into separate trains. This long-term post-accident alignment eliminates the possibility of disabling the entire component cooling water system due to a passive failure. Final Safety Analysis Report Update 9.2.?.2, "AuxiliarySaltwater System," identified that in the long-term recirculation phase of post-accident operation, the headers are aligned to provide separate redundant systems, each consisting of a pump, supply header, and heat exchanger.
These, along with Section 3.1-2, identified the auxiliary saltwater and component cooling water separation long-term post-accident recirculation as an action taken to eliminate the possibility of disabling the system in the event of a passive failure. Section 3.1.1.1 of the Final Safety Analysis Report Update defined short-term as the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an incident and long-term as the recovery period following short-term.
Sections 8.1-3 and -5, which address the electrical system design basis states, "The electrical systems are designed so that the failure of any one electrical device willnot prevent operation of the minimum engineered safety features equipment." Also, "The ESF and their onsite [electrical] sources are grouped so the functions required during a major accident are provided regardless of any single failure in the electrical system."
Unreviewed Safet Question Determination The inspectors found that the license basis impact evaluation focused on the active failure that could result in the loss of the ultimate heat sink during the recirculation phase following a loss-of-coolant accident.
The licensee did not adequately consider the Final Safety Analysis Report Update statements that the component cooling water and auxiliary saltwater systems would be separated by their individual trains to prevent a common mode passive failure.
In this case the licensee's 10 CFR 50.59 program was not effectively utilized to determine whether the proposed procedural change represented a potential unreviewed safety question.
The licensee utilized the 10 CFR 50.59 process as a means of validating the emergency operating procedural change and did not correctly provide a licensing basis determination for an unreviewed safety question.
However, the NRC recognizes the significance of a potential common mode active failure versus a passive failure and the operator actions that could be taken for each type of event.
Plant-specific and generic failure data used in determining probabilistic risk for the plant, which is outside the scope of 10 CFR 50.59, indicated that there is a greater probability of losing the ultimate sink from an active bus failure with the trains
-6-separated, than from a passive failure with the trains combined.
The decision to utilize the Technical Support Center to assess the overall plant conditions prior to separating the trains is appropriate to ensure that an integrated consideration would be given to active and passive failure considerations and should result in the optimum configuration for the auxiliary saltwater and component cooling water trains to best support long-term recovery.
The licensee submitted License Action Request 98-02, AuxiliarySalt Water/Component Cooling Water Operation During Long-Term Recovery Period, to address this issue.
Conclusions The NRC staff determined this to be a nonsubstantial unreviewed safety question.
The licensee's corrective action to assess the condition of the component cooling water system and auxiliary saltwater system in determining the plant configuration for long-term plant cooling was appropriate.
The NRC has determined that the exercise of discretion in accordance with VII.B.6of the NRC Enforcement Policy is appropriate and no Notice of Violation willbe issued.
E1.1.2 Residual Heat Removal and Containment S ra Ins ection Sco e
The inspectors reviewed the emergency operating procedure changes for the containment spray function by the residual heat removal system during the recirculation phase of a loss-of-coolant accident.
The respective license basis impact evaluation and regulatory requirements were reviewed to assess whether the changes involved an unreviewed safety question.
Observations and Findin s Backcaround NRC Inspection Report 50-275; -323/97-202, Section E1.3.1.2, identified the changes in the emergency operating procedures for operation of the containment recirculation spray function following a loss-of-coolant accident, as Unresolved Item 50-275;
-323/97-202-10.
In 1991, the licensee identified through the review of design calculations for containment heat removal following a loss-of-coolant accident, that the heat loads from the residual heat removal system during the cold-leg recirculation phase may cause component cooling water temperature design basis limits to be exceeded during certain conditions.
This condition was documented in Nonconformance Report DCO-91-FN-N030, "The Heat Loads Placed on the CCW System by the Containment fan Coolers and RHR Heat Exchangers Following a LOCA May Cause the CCW Temperature to Exceed its Design Basis Limit,"dated December 13, 1991. The immediate corrective actions involved placing two auxiliary saltwater pumps and two component cooling water heat exchangers in service on each unit; notifying the shift supervisors of the potential for high component cooling water temperatures during cold-leg recirculation; and revising
-7-Emergency Operating Procedures E-1.3, "Transfer to Cold Leg Recirculation." This was to ensure that component cooling water temperature remained within the design limits.
The licensee provided telephone notification to the NRC in December and identified this condition in Licensee Event Report 1-91-0018, dated January 17, 1992.
The licensee revised the emergency operating procedures to discontinue containment spray (which uses residual heat removal flow) during recirculation with only one residual heat removal pump in operation.
This was based on the capability of the containment fan cooling units to maintain containment pressure low. Specifically, Emergency Operating Procedure E-1.3, "Transfer to Cold Leg Recirculation," Revisions 9 and 3 for Units 1 and 2, respectively, were revised to delete starting a residual heat removal pump in the containment spray mode if only one pump was available and to move the decision to place a residual heat removal pump in the containment spray mode to the Technical Support Center.
Operability Evaluation 91-15R5, "Component Cooling Water System Temperature During Post Loss of Coolant Accident Reactor Coolant System Recirculation," issued in January 1992 and last dated September 15, 1992, identified that a single residual heat removal pump operating in the recirculation mode, would not provide sufficient flow and/or discharge head pressure to provide both containment spray and full cold-leg injection flow. This condition could also occur with the single failure of a residual heat removal pump. The operability evaluation relied, in part, on the safety analysis performed by Westinghouse, dated January 10, 1992.
Westinghouse issued a final safety evaluation for an emergency operating procedure change to address excessive component cooling water system temperature during recirculation phase in SECL-91-458, Revisions 0 and 1, by letter dated February 17, 1992. The safety evaluation concluded that the proposed change to emergency
'perating Procedure E-1.3 did not affect the integrity of any safety-related system nor did it result in an unreviewed safety question based on the requirements and definitions delineated in 10 CFR 50.59. The licensee later identified that this safety evaluation was the primary document that allowed for the Emergency Operating Procedure E-1.3 changes,'although it had not been finalized at the time the changes were made.
The safety evaluation was also not reviewed by the Plant Safety Review Committee.
In February 1992 the licensee initiated an update to the Final Safety Analysis Report Update, Revision 8, to delete the reference in Section 6.2.3.2.1, "General Description,"
regarding the use recirculation spray for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after an accident.
In June 1997 the licensee provided a submittal of improved technical specifications to remove the requirement for transfer to spray recirculation with residual heat removal.
Action Request A0442630, "Prompt Operability Evaluation: Degraded Condition,"
dated August 28, 1997, assessed whether a potential violation of Technical Specifications 3.6.2.1 existed because the emergency operating Procedure E-1.3 did not provide direction to align for recirculation spray if only train of residual heat is in operation.
The licensee identified that the containment recirculation spray is not credited in containment integrity analysis or dose analyses.
Loss of this function would not violate the design bases analysis for loss-of-coolant accident mitigation, offsite dose,
-8-hydrogen generation or environmental qualification. A subsequent safety analysis completed on September 4, 1997, downgraded the containment spray in the recirculation mode of the emergency core cooling to nonsafety-related.
The license identified that Emergency Operating Procedure E-1.3 provided a caution statement that required the containment spray to be operated for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following initiation. This requirement was removed from the emergency operating procedure on January 16, 1998.
Re ulato Review Technical Specification 3.6.2.1 requires two containment spray systems be operable with each spray system capable of taking suction from the refueling water storage tank and transferring spray function to a residual heat removal system taking suction from the containment sump.
Technical Specifications Bases 3/4.6.2.1, "Containment Spray System," stated that the operability of the containment spray system ensures that the containment depressurization and cooling capability will be available in the event of a loss-of-coolant accident.
Technical Specification Bases 3/4.6.2.3, "Containment Cooling System," specified that any two containment fan coolers in conjunction with one train of containment spray are capable of providing adequate containment heat removal to assure that the maximum containment design pressure is not exceeded following a loss-of-coolant accident.
The Final Safety Analysis Report Update, Section 3.1.8.16, specified that the containment heat removal system, designed to comply with the July 1967, General Design Criteria 52, consisted of the containment spray and containment fan cooler systems.
Final Safety Analysis Report Update, Section 6.2.2.2.2.1, specified that during the recirculation phase of the accident, "Recirculatio'n spray suction is provided by the residual heat removal pumps, which draw suction from the containment sump." The Final Safety Analysis Report Update, Section 6.2.3.2.1, identified that the mode of containment spray willcontinue for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the accident.
The safety evaluations performed in 1991 and February 1992 identified the operation of the residual heat removal system for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in the containment spray mode but did not identify that the change to the procedure would involve a change to the technical specification requirement for the containment spray system during recirculation. This is a violation of 10 CFR 50.59 for the change to the emergency operating procedures requiring NRC approval because it involved a change to the technical specifications incorporated into the license (50-275; -323/9809-01).
Conclusion The 10 CFR 50.59 program was not effectively utilized in this case to determine whether the procedure change represented a potential unreviewed safety question or affected the technical specifications.
A violation of 10 CFR 50.59 was identified for the changes made in the emergency operating procedures as described in the safety analysis report, without prior Commission approval, that involved a change in the technical specifications incorporated in the licens \\
~
/
-9-E1.1.3 Com onent Coolin Water S stem Sur e Tank Pressurization The inspectors reviewed the changes to the component cooling water surge tank to add the nitrogen pressurization system.
The respective license basis impact evaluation and regulatory requirements were reviewed to assess whether the changes involved an unreviewed safety question.
Observations and Findin s
~Back round On February 13, 1996, the licensee determined that component cooling water, which is circulated through the containment air coolers, could flash to steam in the cooler unit cooling coils during a design-basis loss-of-coolant accident with a concurrent loss of offsite power or with a delayed sequencing of equipment.
This condition was reported to the NRC in Licensee Event Report 1-96-005, dated April26, 1996.
The licensee reported that, during a postulated design-basis loss-of-coolant accident with a concurrent loss of offsite power, the component cooling water pumps and the air cooler fans willtemporarily lose power (an expected condition). The component cooling water flowwould stop almost immediately, white the fans'coast down over a period of minutes.
The first air cooler fan will restart on slow speed approximately 22 seconds after the loss of offsite power and the component cooling water pumps will restart 4 to 8 seconds later.
In this scenario, the high-temperature containment atmosphere willbe forced across the containment air cooler's cooling coils for up.to 30 seconds with no forced component cooling water flowthrough the coolers.
The licensee determined that the stagnant component cooling water in the containment air coolers may boil and create a substantial steam volume in the component cooling water system.
As the component cooling water pumps restart, the pumped liquid may rapidly condense this steam volume and produce a water hammer.
The hydrodynamic loads introduced by such a water hammer event could be substantial, challenging the integrity and function of the containment air coolers and the associated component cooling water system, as well as, posing a challenge to containment integrity. As corrective action, the licensee installed a nitrogen pressurization system on the component cooling water head tank to increase the margin to boiling. On June 20, 1996, Westinghouse Electric Corporation issued Nuclear Safety Advisory Letter NSAL-96-003, "Containment Fan Cooler Operation During a Design Basis Accident," to alert its customers to this potential safety issue.
In NSAL-96-003, Westinghouse recommended that licensees review their containment cooling systems to determine if their safety-related containment air coolers are susceptible to water hammer.
The licensee and their contractors performed extensive calculations to determine the extent of flashing and the magnitude of the subsequent water hammer that could occur when the component cooling water pumps restarted on the emergency diesel
~ generators.
The results from these calculations were inconclusive in showing that a water hammer would not over stress the component cooling water coils in the fan cooler
-10-units. As a result of the inconclusive calculations and because the Final Safety Analysis Report Update indicated that boiling would not occur in the fan cooler units, the licensee designed a modification to pressurize the Unit 1 and Unit 2 component cooling water system surge tanks.
The modification, which utilized a nitrogen pressurization system to ensure that boiling would not occur in the fan cooler coils, was installed in April 1996 while Unit 1 was online and before Unit 2 ended its seventh refueling outage in May 1996.
Re ulato Review On April 26, 1996, the licensee submitted Licensee Event Report 1-96-005, which described the issue of potential flashing in the component cooling water system and the corrective action to install the nitrogen pressurization system.
Installation of the Anal s's pressurization system maintained the provisions of Section 9.2.2.2.7 of the Fi I S f iy y is Report Update, which indicated that no local boiling would take place in the ina a
Bay'ontainment fan cooler unit coils during accident conditions.
A meeting was held between the licensee and the NRC on October 1, 1996, to discuss the licensee's analysis of the issue and the design and operation of the nitrogen pressurization system.
During the meeting, the NRC questioned the licensee's control of the pressurization system through an equipment control guideline rather than the I'echnical specifications since the pressurization system was installed to supp rt icensing basis assumptions for the loss-of-coolant accident.
The licensee subsequently submitted their pressurization system licensing basis impact evaluation to the NRC on June 12, 1997.
On June 23, 1997 the NRC issued a lette t
e lic nsee, which expressed concerns related to the 10 CFR 50.59 safety evaluation contained in the licensing basis impact evaluation.
The NRC staff indicated that the licensee's modification introduced vulnerabilities that were not previously considered in NRC approval of the system design.
The NRC staff's concerns included the impact of dissolved nitrogen on component cooling water pump net-positive suction head a d th p t ntial of vapor binding of the pumps, the effect of dissolved nitrogen on thermal n
e conductivity, equipment malfunctions and single failure considerations, and the potential for increasing the consequences of an accident during installation of the modification.
The licensee responded to the NRC staff's concerns in a letter dated August 28, 1997.
The licensee indicated that the concerns had been previously evaluated during the
.
design process and that there was a sound basis for concluding that the design did not introduce new malfunctions or increase the consequences of an accident.
The NRC staff reviewed the licensee's August 28, 199?, and concluded that the licensee's evaluations relied heavily on engineering judgement and measures not specifically reviewed and approved by the staff for Diablo Canyon.
In addition, the staff indicated that the licensee modifications involved a change to the technical specifications.
Consequently, the staff concluded that the licensee should have submitted the component cooling water system modification for NRC review and approval.
The Unit 1 modification was installed using Design Change Package M-049284, and the Unit 2 modification was installed using Design Change-Package M-050284. The inspectors reviewed the design change packages and the associated licensing basis impact evaluations and found that the licensee used engineering judgement in
-11-concluding that binding of the component cooling water pumps would not occur if the system depressurized, and the nitrogen came out of solution.'he licensee also used judgement in concluding that the nitrogen would not affect system heat transfer assumptions.
Section 9.2.2.2.7 of the Final Safety Analysis Report Update indicated that no local boiling would take place in the containment fan cooler unit coils during accident conditions.
However, the inspectors found that the 10 CFR 50.59 review was inadequate in that the impact of dissolved nitrogen on component cooling water pump net-positive suction head and the potential of vapor binding of the pumps, the effect of dissolved nitrogen on thermal conductivity, equipment malfunctions and single failure considerations, and the potential for increasing the consequences of an accident during installation of the modification was not considered in the licensing basis impact evaluation provided in the licensee's submittal dated June 12, 1997 (DCL-97-108).
Changes to the technical specifications were not adequately considered until May 22, 1997, when the licensee provided a submittal requesting NRC review and approval of a technical specification change to include new action statements and surveillance requirements for the component cooling water surge tank pressurization system.
At the close of this inspection, the NRC was reviewing the license amendment request.
The inspectors identified the inadequate 10 CFR 50.59 review for the component cooling water nitrogen pressurization system as a second example of Violation 50-275; -323/9809-01.
Conclusions A second example of an inadequate 10 CFR 50.59, licensing basis review, was identified for changes to the component cooling water system.
The initial review by the licensee was inadequate to provide the bases for the determination that the proposed change did not involve an unreviewed safety question or a change in the technical specification incorporated in the license.
E1.1.4 Auxilia Saltwater S stem Pi in B
ass Modification Ins ection Sco e
The inspector's reviewed the license basis impact evaluation for the changes which resulted from the auxiliary saltwater system piping bypass modification. The respective regulatory requirements were reviewed to assess whether the change involved an unreviewed safety question.
Observations and Findin s Backca round In 1992, the licensee discovered a hole in an access port for buried auxiliary saltwater piping located near the turbine building. The licensee determined that the hole developed due to external corrosion, and the licensee initiated a program to assess aging of the buried piping. By 1995, the licensee identified piping areas prone to external corrosion and had taken action to arrest the corrosion and effect repair However, the licensee was unable to inspect buried piping in the tidal zone near the intake structure and determined that a design change should be implemented to bypass the potentially corroded pipe. The auxiliary saltwater system piping modification resulted in bypassing approximately 800 feet of Unit 1 piping and 200 feet of Unit 2 piping. The final connections to existing auxiliary saltwater piping were completed in May 1997 and February 1998 during the eighth refueling outage for Unit 1 and Unit 2, respectively.
The licensee sited the bypass piping in trenches, which were later backfiiied. 'The primary siting difference between the existing piping and the bypass piping was that the existing piping was anchored to rock and the bypass piping was supported by soil.
Concrete thrust blocks were used to provide bypass piping support, and flexible couplings were employed to limit piping loads in seismic events.
During design of the modification, consultants obtained soil samples and performed soil analysis to confirm inputs used in seismic response analysis for the bypass piping. The consultants identified a soil zone in the Unit 1 piping path that was potentially susceptible to liquefaction. The zone in question was 10 to 20 feet wide, 100 feet long, about 5 feet thick, and about 25 feet below the ground surface.
The licensee's consultant predicted that the potentially liquefiable zone could settle about one inch after a Hosgri earthquake, with less settling if modern liquefaction analytical techniques were used.
The licensee used the predicted settlements in the piping analysis and verified that the bypass piping would be capable of fulfillingits required function under all design conditions.
Re ulato Review The NRC staff questioned the licensee about the scope of the bypass modification and whether the licensee intended to obtain NRC review and approval.
Although the licensee intended to perform the modification using the provisions of 10 CFR 50.59, the licensee made a January 27, 1997, information submittal to the NRC, which included a project description, safety evaluation, and 10 CFR 50.59 determination.
The NRC and the licensee subsequently held a meeting to discuss the modification, and the NRC issued a letter requested additional information about the project.
On August 15, 1997, the NRC staff stated their opinion to the licensee that the modification involved an unreviewed safety question.
The NRC provided a final position to the licensee in a December 3, 1997, letter.
The NRC's determination that the modification involved an unreviewed safety question was based on the potential for liquefaction described in the Final Safety Analysis Report Update.
Specifically, Section 2.5A.8 indicated that adverse hydrologic effects on foundations of Seismic Category I structures can be neglected due to the structures being founded on bedrock.
As a result of the Unit 1 piping being sited in soil with the potential for liquefaction, the NRC staff concluded that there was a possibility for an accident or malfunction of a different type other than previously evaluated in the Final Safety Analysis Report Update.
The condition was not applicable to the Unit 2 piping modificatio The licensee implemented the Unit 1 modification using Design Change Package C-049207.
The licensee revised the design change package as different phases of the modification were implemented, and the licensee revised a licensing basis impact evaluation for each revision. The inspectors reviewed the licensing basis impact evaluations and observed that Revision 7, issued February 21, 1997, indicated that Section 2.5.4.8 of the Final Safety Analysis Report Update would be revised.
The inspectors reviewed the proposed change to the Final Safety Analysis Report Update and observed that it described the zone of soil susceptible to liquefaction and indicated that associated liquefaction induced settlements were considered in the design of the piping bypass modification.
The inspectors also reviewed the 10 CFR 50.59 safety evaluations associated with the licensing basis impact evaluations and observed that they did not specifically discuss the possibility of liquefaction. However, the evaluations indicated that the design of the modification had been thoroughly analyzed, that design features had been incorporated to assure integrity of the auxiliary saltwater system, and that licensing basis considerations had been addressed.
The licensee concluded that an accident or malfunction of a different type previously evaluated in the Final Safety Analysis Report Update would not occur.
The Final Safety Analysis Report Update, Section.2.5.4.8, indicated that adverse hydrologic effects on foundations of Seismic Category I structures can be neglected due to the structures being founded on bedrock.
The licensee implemented the Unit 1 modification using Design Change Package C-049207.
The 10 CFR 50.59 safety evaluations associated with the licensing basis impact evaluations did not specifically discuss the possibility of liquefaction. The evaluations indicated that the design of the modification had been thoroughly analyzed, that design features had been incorporated to assure integrity of the auxiliary saltwater system, and that licensing basis considerations had been addressed.
The NRC staff stated in a letter dated December 3, 1997, that an unreviewed safety question exists for the auxiliary saltwater bypass piping being sited over liquefiable soil, such that there is the possibility for an accident or malfunction of a different type than previously evaluated in the Final Safety Analysis Report Update.
This is a violation of 10 CFR 50.59 (50-275/9809-02).
Licensee Actions On August 26, 1997, the licensee submitted a license amendment request for NRC review and approval of the auxiliary saltwater piping system bypass modification. The licensee submitted the application after NRC staff indicated that the modification involved a potential unreviewed safety question.
At the close of this inspection, the NRC staff was reviewing the license amendment request.
Conclusions A violation of 10 CFR 50.59 was identified for failing to obtain prior NRC approval for siting a segment of the Unit 1 auxiliary saltwater bypass line sited on ground not made of bedrock as specified in the Final Safety Analysis Report Update which was determined by the NRC to involve an unreviewed safety questio n E1.2 a.
-14-10 CFR 50.59 Process Im lementation The inspectors assessed the four issues, which had been considered as potential unreviewed safety questions for insights into the licensee's 10 CFR 50.59 implementation process.
b.
Observations and Findin s The inspectors considered the timing of the reviews with regards to when the modifications and procedure changes were implemented.
In these cases, such as the auxiliary saltwater bypass line modification, the 10 CFR 50.59 evaluation was performed at the end of the design modification process.
This meant that a finding of an unreviewed safety question existed would have resulted in a delay in implementing the modification. Emerging issues, which involved potential unreviewed safety questions and associated resolution were focused on resolving the technical issue and the engineering and operational fixes were put into place for consideration during the 10 CFR 50.59 evaluation.
This directed the evaluations at assessing the adequacy of
.
the engineering and operational fix rather than focusing on whether the issues involved new probabilities or consequences from the previously established licensing basis.
These issues had been independently identified by the licensee and were being addressed through their corrective action process.
Conclusions The 10 CFR 50.59 program was not effectively utilized in these cases to determine whether proposed design or procedural changes represented potential unreviewed safety questions or affected the technical specifications.
Design and procedural changes essentialiy utilized the 10 CFR 50.59 process as a means of validating the design or procedural changes but did not correctly provide a licensing basis determination.
E7 Quality Assurance in Engineering Activities E7.1 Corrective Action Identified Issues for Im rovement to the 10 CFR 50.59 Evaluation Process
,~Sco e
The inspectors reviewed the licensee's previous and ongoing actions to address 10 CFR 50.59 program implementation concerns and deficiencies.
t Observations and Findin s The licensee provided a white paper" dated May 5, 1998, which addressed each of the potential unreviewed safety questions.
The white paper" stated that the changes were performed in accordance with 10 CFR 50.59 at the time they were done and that
-15-unreviewed safety questions were not involved; therefore, NRC approval was not required prior to their implementation.
However, following identification of potential NRC concerns, the licensee took prompt and comprehensive actions pending NRC and industry resolution of 10 CFR 50.59 implementing issues.
The licensee submitted the following licensing action requests:
Licensing Action Request 97-11, AuxiliarySalt Water Piping Bypass Modifications License Action Request 97-05, Component Cooling Water Surge Tank Pressurization License Action Request 98-02, AuxiliarySalt Water/Component Cooling Water Operation During Long-Term Recovery Period License Action Request 98-03, Containment Spray During the Recirculation Phase of a Loss of Coolant Accident The licensee established a 10 CFR 50.59 review board consisting of senior licensee management familiar with the plant licensing and design basis, responsible for reviewing future unreviewed safety question issues.
The licensee identified,.that this review board had been used for mid-loop operations and a proposed modification to provide primary system zinc addition.
In addition, the licensee identified that engineering services personnel have been provided training on recent unreviewed safety question issues and associated NRC and industry guidance.
The inspectors reviewed previous findings and corrective actions associated with 10 CFR 50.59 issues.
NRC Inspection Report 50-275; -323/96-21 identified concerns with the failure to perform written safety evaluations prior to making changes to a procedure described in the Final Safety Analysis Report Update.
The associated violation of 10 CFR50.59 involved multiple instances of failure of the licensee to properly evaluate changes to a risk significant emergency operating procedure that contained time dependent actions required in order to provide core cooling in the event of a loss-of-coolant accident.
The multiple instances of failure to properly review changes to a procedure described in the Final Safety Analysis Report Update raised concerns with a potentially programmatic problem with the licensee's procedure revision process.
Subsequently, NRC Inspection Report 50-275; -323/96-23 documented findings and a Notice of Violation involving missed reviews by the Plant Staff Review Committee of 10 CFR 50.59 safety'evaluations as required by the technical specifications.
The licensee initiated Nonconformance Report N002008 on December 12, 1996, to address specific 10 CFR 50.59 issues, which were identified as a result of its review of the above findings and subsequent Notice of Violation.,The licensee found, in part, that there were concerns with the initial screening and licensing basis impact evaluation process, and the reviewer's ability to identify all the potential safety issues.
The licensee
-16-I identified specific concerns, which included the tools for searching the licensing basis were slow and tedious to use; the licensing basis information was scattered through many documents; the licensing basis impact evaluation initiators and screeners lacked the knowledge and skills to do an excellent job; and there were no provisions established for requalification training.
The corrective actions identified for these issues included providing optimized searches of licensing basis information in the engineering management system; providing a desk top instruction for the engineering data management system; providing a universal searchable licensing data base; providing refresher and requalification training to personnel who perform licensing basis impact reviews or screening;.and developing experts and utilizing these personnel for coaching.
Several of these corrective actions were being developed or under licensee review at the time of this inspection.
License Basis Im act Evaluations Follow u Actions and Self Assessments The Nuclear Safety Oversight Committee was provided with the licensing basis impact evaluations process status in August 1997. The process owner identified strengths in the areas of comprehensive procedure, heightened awareness of the process by plant personnel and that the evaluations being performed were appropriate.
However, within these three areas the following were identified for improvement:
(1) the use of search tools and data bases, (2) training and requalification, and (3) procedural improvements.
The licensee provided training in late 1997 on computer search practices to approximately 120 engineering support personnel.
This action was to address the use of the electronic data management system and the movement of 10 CFR 50.59 oversight to regulatory affairs as the process owner.
In December 1997, the licensing basis impact review process was presented to the Nuclear Safety Oversight Committee.
The committee identified a need to develop an approach to identify or potential unreviewed safety questions at least 6 months in
'advance of an outage to allow for submittal and review by NRC staff if necessary.
The licensing basis impact evaluation procedure was revised in June 1997 (TS3.ID2,
"Licensing Basis Impact Evaluations," Revision 3) to enhance the review process.
Approximately 360 of the licensee's staff that may implement the license basis impact evaluation procedure, were provided with continued training (TU973R2) on unreviewed safety questions.
The training plan included references to the component cooling water system pressurization and the auxiliary saltwater bypass line modifications. Additional continued training was provided on configuration management (TU971R2), which included design control.
The Licensing Basis Impact Evaluation 1997 Process Owner Report recommended setting up a panel of licensing basis impact evaluation review experts or other review methods to assure proper unreviewed safety question determinations are made.
The licensee also identified the need to provide a panel of licensing basis impact review experts and other review methods to assure proper unreviewed safety question determinations.
In addition, the licensee established a dialogue with the NRC's Office of Nuclear Reactor Regulation regarding 10 CFR 50.59 issues.
The Nuclear Safety Assessment and Licensing Quality Plan for December 1997 and March 1998 addressed
-17-licensing basis impact evaluation issues including industry initiatives, training and awareness, process changes, process owner activities, and recommended improvements in each of the identified areas.
In March 1998, the licensee identified that the transition of the licensing basis impact evaluation review process to regulatory services had been implemented.
The process was also being implemented earlier for the identification and review of 10 CFR 50.59 issues for significant plant changes, and establishment of a pre-Plant Safety Review Committee management review for significant 10 CFR 50.59 issues.
The licensee's action plan, developed in response to Non Conformance Report N002008, addressed the three areas, which were identified as concerns during the inspection.
These were the establishment and implementation of a requalification program for performing licensing basis impact evaluation reviews, development of a licensing basis impact evaluation review screen and writers guide, and communication of the improved safety analysis search capabilities to the licensing basis impact evaluation preparers.
However, the licensee also identified that the previous corrective actions to Nonconformance Report N002008 had not been completely or effectively implemented.
Action Item A0459909, dated April 16, 1998, was initiated to track corrective actions associated with Non Conformance Report N002008.
This action request provided for addressing 10 CFR 50.59 training for operations.
Conclusions The licensee initiated specific steps to strengthen the 10 CFR 50.59 process.
The licensee placed the principle focus through the regulatory services group; established communications with Office of Nuclear Reactor Regulation regarding 10 CFR 50.59 issues; and implemented a management review committee, consisting of management personnel cognizant of the 10 CFR 50.59 process, to review specific safety evaluations The effectiveness of the licensee's corrective actions to resolve 10 CFR 50.59 implementation issues (identified back to December 1996) had not been fullyrealized and had not been independently assessed by the licensee's quality organization.
Periodic reviews were provided by the process owner to the onsite and offsite review committees regarding 10 CFR 50.59 procedural, training and overall program enhancements, which provided a general status of the program changes.
E8 Miscellaneous Engineering Issues (92903)
E8.1 Closed Unresolved Item 50-275 323-202-03: The architect and engineering team identified that the auxiliary saltwater system operation did not conform to the original auxiliary saltwater design or licensing basis and involved a potential unreviewed safety question.
This item was determined to be a nonsubstantial unreviewed safety question.
The licensee's corrective action to assess the condition of the component cooling water system and auxiliary saltwater system in determining the plant configuration for long-term plant cooling was appropriate.
The NRC has determined that the exercise of discretion in accordance with VII.B.6 of the NRC Enforcement Policy is appropriate and no Notice of Violation will be issued.
This is addressed in Section E1.1.1 to this repor E8.2 Closed Unresolved Item: 50-275 -323/202-10:
The architect and engineering team identified that prohibiting containment spray during recirculation, if only one residual heat removal pump was available, was a potential unanalyzed consequence of the malfunction of equiprhent important to safety.
This was determined to be a violation of 10 CFR 50.59 for a change to the emergency operating procedures, which involves a change to the technical specifications incorporated into the license (50-275;
-323/9809-01) and is described in Section E1.1.2 of this report.
V. Mana ement Meetin s X1 Exit Meeting Summary f
The inspectors presented the inspection results to members of licensee management on May 7 and provided an exit meeting summary by telephone on July 21, 1998. The licensee had previously stated that they did not believe the issues involved unreviewed safety questions.
The inspectors documented the licensee's position in Section E.7 of this report, as well as, several of the actions the licensee had taken and were being taken to strengthen the 10 CFR 50.59 process.
The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary.
No proprietary information was identifie ATlACHMENT SUPPLEMENTAL INFORMATION PARTIALLIST OF PERSONS CONTACTED Licensee K. Bych, Supervisor, Probabilistic Risk Assessment B. Crockett, Manager, Engineering Services R. Gray, Director, Radiation Protection T. Grebel, Director, Regulatory Services J. Hodges, Supervisor, Engineering S. Kettlesen, Supervisor Nuclear Services D. Miklush, Manager, Engineering Services J. Molden, Manager, Operations Services P. Nugent, Supervisor, Regulatory Services J. Portney, Senior Engineer M. Sharp, System Engineer J. Shoulders, Director Design Services D. Taggart, Director, Nuclear Quality Services J. Tompkins, Supervisor, Engineering D. Vosaurg, Director, Nuclear Services B. Waltos, Assistant Manager, Engineering Services L. Womack, Vice President, Nuclear Technical Services INSPECTION PROCEDURES (IP) USED IP 37551 IP 92903 Onsite Engineering
~ Followup-Engineering ITEMS OPENED'AND CLOSED
~Oened 50-275/98-09-01 YIO 50-275; 323/9809-02 VIO A violation of 10 CFR 50.59 was identified, with two, examples, for changes to the component cooling water system and a procedural revision for the operation of the residual heat removal system during containment recirculation.
A violation of 10 CFR 50.59 was identified for a segment of the Unit 1 auxiliary saltwater bypass line not being on ground made of bedrock as specified in the Final Safety Analysis Repor Closed 50-275/97-202-03 URI Long-term post LOCA operation of the auxiliary saltwater and component cooling water trains 50-275/97-202-10 URI Potential unreviewed safety question and technical specification adherence associated with containment spray during containment recirculation